Substack's Digital Empire Breached: CEO Warns Users of Stolen Data
In a concerning turn of events, digital publishing platform Substack has revealed that its user data was compromised in a security breach. The hack, which occurred in October 2025, saw unauthorized individuals access the email addresses and phone numbers of affected users.
Substack's CEO, Christ Best, notified some of his users through an email posted on Bluesky, stating that the breach involved "limited user data" being accessed without permission by an unauthorized third party. However, it appears that sensitive information such as credit card numbers was not compromised in the hack.
Best also assured users that no passwords were obtained during the breach and that internal metadata was shared. Nevertheless, he urged affected account holders to remain vigilant for suspicious emails or text messages they may receive.
In response to the breach, Substack has acknowledged that its security vulnerabilities have been addressed, with Best stating that the company is conducting a full investigation into the incident. He emphasized that steps are being taken to improve systems and processes to prevent similar incidents from occurring in the future.
Despite no evidence of the stolen data being misused, affected users are advised to remain cautious. The exact number of compromised accounts remains unclear, although it's reported that 697,313 stolen records were leaked on the hacking forum BreachForums.
In a concerning turn of events, digital publishing platform Substack has revealed that its user data was compromised in a security breach. The hack, which occurred in October 2025, saw unauthorized individuals access the email addresses and phone numbers of affected users.
Substack's CEO, Christ Best, notified some of his users through an email posted on Bluesky, stating that the breach involved "limited user data" being accessed without permission by an unauthorized third party. However, it appears that sensitive information such as credit card numbers was not compromised in the hack.
Best also assured users that no passwords were obtained during the breach and that internal metadata was shared. Nevertheless, he urged affected account holders to remain vigilant for suspicious emails or text messages they may receive.
In response to the breach, Substack has acknowledged that its security vulnerabilities have been addressed, with Best stating that the company is conducting a full investigation into the incident. He emphasized that steps are being taken to improve systems and processes to prevent similar incidents from occurring in the future.
Despite no evidence of the stolen data being misused, affected users are advised to remain cautious. The exact number of compromised accounts remains unclear, although it's reported that 697,313 stolen records were leaked on the hacking forum BreachForums.
like what if those credit card numbers got sold online?? We need to make sure our info is safe, especially when we're sharing it with apps and websites. It's kinda creepy that 697k records got leaked online... how do they even get access to that much data?! anyway, I'm gonna keep a closer eye on my accounts now 
and they're like "oh no our user data was compromised"... yeah no kidding, dude 
, I mean we all knew it was only a matter of time before some hackers came knocking on their digital door 
. 697k records leaked online? that's just a bunch of spam waiting to happen 
... anyway, cheers to substack for owning up and promising to fix the mess 
... now if you'll excuse me, I've got more important things to worry about... like where did I put my password manager 
... Substack, which is like one of those super popular platforms for writers and creators to share their work, got hacked! 
Can you believe it? They've got a lot of users, including some big names, so this could be bad news for them.
. That's cool, I suppose.
. And honestly, that's probably a good idea? You never know who might've gotten access to your email address and phone number... 
oh man, this is not good at all... i mean, substack is like a go-to platform for writers and journalists to share their work and connect with readers... and now they're dealing with this major security breach? 
it's like, you'd think that would be a no-brainer to protect user data, but apparently it took an unauthorized third party to figure that out... 
substack should be super transparent about what's going on too, like, they're already doing but still... 
anyway substack's got a plan to make sure this doesn't happen again... that's what i'm rooting for 
. And 697k records leaked on some hacking forum? That's just creepy 
. Can't wait for them to get their act together so I can trust my info again 
.
. And Christ Best's email about no passwords being compromised is like, totally reassuring... till you think about how internal metadata was shared, right? 
. Let's just hope these users get some closure soon 
. 697k records leaked on breachforums 
.
. That takes a lot of courage and responsibility. Maybe this is an opportunity for us all to take a closer look at how we're handling our online security 
I'm not saying I'd be too paranoid or anything, but I think it's always better to be safe than sorry, you know? Substack should've had some kind of backup plan in place for this kinda thing... maybe they can take a cue from old-school banks and have an emergency email or something.
